NetKnow Corporate Blog

From - Wed Jun 27 15:16:59 2007

X-Account-Key: account2

X-UIDL: MUi"!G>
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

Received: from doctor.nl2k.ab.ca

by doctor.nl2k.ab.ca (8.14.1/8.14.1) with ESMTP id l5RCkRj4017256

for ; Wed, 27 Jun 2007 06:46:32 -0600 (MDT)

Received: (from doctor@localhost)

by doctor.nl2k.ab.ca (8.14.1/8.14.1/Submit) id l5RCkQTO017254

for dave@doctor.nl2k.ab.ca; Wed, 27 Jun 2007 06:46:26 -0600 (MDT)

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Wed, 27 Jun 2007 06:46:26 -0600

Resent-Message-ID: <20070627124626.GE12284@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from mta9.adelphia.net

by doctor.nl2k.ab.ca (8.14.1/8.14.1) with ESMTP id l5R95UE9014034

for ; Wed, 27 Jun 2007 03:05:48 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from web37 ([68.168.75.144]) by mta9.adelphia.net

(InterMail vM.6.01.05.02 201-2131-123-102-20050715) with ESMTP

id <20070627090523.VFAQ6326.mta9.adelphia.net@web37>;

Wed, 27 Jun 2007 05:05:23 -0400

Message-ID: <14174802.1182935123101.JavaMail.root@web37>

Date: Wed, 27 Jun 2007 2:05:22 -0700

From: British Online Co-ordinators

Reply-To: contactofficerrichard@yahoo.co.uk

Subject: {Spam?} REF No: UK/3670X5/79

X-Priority: 3 (Normal)

Sensitivity: Normal

X-NetKnow-InComing-4.61.3-1-MailScanner: Found to be clean, Found to be clean

X-NetKnow-InComing-4.61.3-1-MailScanner-SpamCheck: spam, SORBS-DNSBL,

SORBS-SPAM, RFC-IGNORANT-POSTMASTER, RFC-IGNORANT-ABUSE,

SpamAssassin (not cached, score=1.681, required 1,

BOTNET_SERVERWORDS 0.00, MISSING_HEADERS 1.58, RDNS_NONE 0.10)

X-NetKnow-InComing-4.61.3-1-MailScanner-SpamScore: s

X-Spam-Status: Yes, No

X-NetKnow-InComing-4.61.3-1-MailScanner-Information: Please contact the ISP for more information

X-NetKnow-InComing-4.61.3-1-MailScanner-From: doctor@doctor.nl2k.ab.ca

X-UIDL: MUi"!G>
X-Antivirus: AVG for E-mail 7.5.476 [269.9.8/869]

Mime-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Type: text/plain; charset=utf-8





--

REF No: UK/3670X5/79

TICKET No: 20511465463-7644

LUCKY No: 887-13-865-37-10-83



FINAL NOTIFICATION



We are pleased to inform you of the result of the winners of the UK

LOTTERY ONLINE PROMO PROGRAMME, held on the 1st of June, 2007.



You have been approved for the payment of =C2=A31,450,000

(One Million,Four Hundred and Fifty Thousand Pound Sterling) in cash

credited to file XYL/26510460037/06 .To file for your claim, contact our

claims agent below:

Sir Donovan Green

D/L +44 704 571 3866

Email: donovan@donovan.vossnet.co.uk

OR donovangreen_agent01@myway.com



Provide him with the information below:



1.Name:....................... 2.Address:........................ 3.Marital=

Status:......

4.Occupation:...................... 5.Age:........ 6.Sex:..........=20

7.Nationality:................

8.Country Of Residence:............=20

9.Phone Number:..................

Congratulations once more !!!.







--=20

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.









--

No virus found in this incoming message.

Checked by AVG Free Edition.

Version: 7.5.476 / Virus Database: 269.9.8/869 - Release Date: 6/25/2007 5:3=

2 PM

From - Sun Jun 24 12:48:52 2007

X-Account-Key: account2

X-UIDL: *T""!C&N!!4$D"!f_*"!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

Received: from doctor.nl2k.ab.ca

by doctor.nl2k.ab.ca (8.14.1/8.14.1) with ESMTP id l5OCewbM009466

for ; Sun, 24 Jun 2007 06:41:03 -0600 (MDT)

Received: (from root@localhost)

by doctor.nl2k.ab.ca (8.14.1/8.14.1/Submit) id l5OCewbq009465

for dave@doctor.nl2k.ab.ca; Sun, 24 Jun 2007 06:40:58 -0600 (MDT)

Resent-From: root@doctor.nl2k.ab.ca

Resent-Date: Sun, 24 Jun 2007 06:40:58 -0600

Resent-Message-ID: <20070624124058.GC2059@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from mta9.adelphia.net

by doctor.nl2k.ab.ca (8.14.1/8.14.1) with ESMTP id l5O1R5BC028048

for ; Sat, 23 Jun 2007 19:27:19 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from web35 ([68.168.75.142]) by mta9.adelphia.net

(InterMail vM.6.01.05.02 201-2131-123-102-20050715) with ESMTP

id <20070624012657.CXYZ6326.mta9.adelphia.net@web35>;

Sat, 23 Jun 2007 21:26:57 -0400

Message-ID: <248049.1182648417907.JavaMail.root@web35>

Date: Sat, 23 Jun 2007 18:26:57 -0700

From: "sgtjarvisreeves008@yahoo.com.cn"

Reply-To: sgtjarvisreeves008@yahoo.com.cn

Subject: {Spam?} HELLO!

X-Priority: 3 (Normal)

Sensitivity: Normal

X-NetKnow-InComing-4.61.3-1-MailScanner: Found to be clean, Found to be clean

X-NetKnow-InComing-4.61.3-1-MailScanner-SpamCheck: spam, SORBS-DNSBL,

SORBS-SPAM, RFC-IGNORANT-POSTMASTER, RFC-IGNORANT-ABUSE,

SpamAssassin (not cached, score=2.348, required 1,

BOTNET_SERVERWORDS 0.00, MISSING_HEADERS 1.58, RDNS_NONE 0.10,

URG_BIZ 0.67)

X-NetKnow-InComing-4.61.3-1-MailScanner-SpamScore: ss

X-Spam-Status: Yes, No

X-NetKnow-InComing-4.61.3-1-MailScanner-Information: Please contact the ISP for more information

X-NetKnow-InComing-4.61.3-1-MailScanner-From: doctor@doctor.nl2k.ab.ca

X-UIDL: *T""!C&N!!4$D"!f_*"!

X-Antivirus: AVG for E-mail 7.5.472 [269.9.6/862]

Mime-Version: 1.0

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=utf-8





--

Hello Pal,

I hope my email meets you well. I am in need of your assistance. My name is Sgt Jarvis Reeves. I am a military attache with the Engineering unit here in Ba'qubah Iraq for the united state, we have about $25 Million dollars that we want to move out of the country. My partners and I need a good partner someone we can trust to actualize this venture.The money is from oil proceeds and legal.But we are moving it through diplomatic means to your house directly or a safe and secured location of your choice using diplomatic courier services.But can we trust you? Once the funds get to you, you take your 40% out

and keep our own 60%. Your own part of this deal is to find a safe place where the funds can be sent to. Our own part is sending it to you. If you are interested I will furnish you with more details,Awaitingyoururgentresponse.sgtjarvisreeves008@yahoo.com.cn

Your Buddy. Sgt Jarvis Reeves



--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.









--

No virus found in this incoming message.

Checked by AVG Free Edition.

Version: 7.5.472 / Virus Database: 269.9.6/862 - Release Date: 6/22/2007 3:04 PM









And analysis says:



gzcat /var/log/maillog.*.gz | egrep 248049.1182648417907.JavaMail.root@web35

Jun 23 19:27:20 doctor sendmail[28047]: l5O1R5wK028047: from=, size=1506, class=0, nrcpts=1, msgid=<248049.1182648417907.JavaMail.root@web35>, proto=ESMTP, daemon=MTA, relay=mta9.adelphia.net [68.168.78.199]

Jun 23 19:27:20 doctor sendmail[28048]: l5O1R5BC028048: from=, size=1506, class=0, nrcpts=1, msgid=<248049.1182648417907.JavaMail.root@web35>, proto=ESMTP, daemon=MTA, relay=mta9.adelphia.net [68.168.78.199]

$whois 68.168.78.199

BW whois 3.4 by Bill Weinman (http://whois.bw.org/)

Copyright 1999-2003 William E. Weinman

Request: 68.168.78.199

connected to whois.arin.net [192.149.252.44:43] ...

Road Runner HoldCo LLC COUDERSPORT-1 (NET-68-168-64-0-1)

68.168.64.0 - 68.168.95.255

Adelphia 68168640-Z14 (NET-68-168-64-0-2)

68.168.64.0 - 68.168.79.255



# ARIN WHOIS database, last updated 2007-06-28 19:10

# Enter ? for additional hints on searching ARIN's WHOIS database.

From - Sun Jun 24 12:48:52 2007

X-Account-Key: account2

X-UIDL: *T""!C&N!!4$D"!f_*"!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

Received: from doctor.nl2k.ab.ca

by doctor.nl2k.ab.ca (8.14.1/8.14.1) with ESMTP id l5OCewbM009466

for ; Sun, 24 Jun 2007 06:41:03 -0600 (MDT)

Received: (from root@localhost)

by doctor.nl2k.ab.ca (8.14.1/8.14.1/Submit) id l5OCewbq009465

for dave@doctor.nl2k.ab.ca; Sun, 24 Jun 2007 06:40:58 -0600 (MDT)

Resent-From: root@doctor.nl2k.ab.ca

Resent-Date: Sun, 24 Jun 2007 06:40:58 -0600

Resent-Message-ID: <20070624124058.GC2059@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from mta9.adelphia.net

by doctor.nl2k.ab.ca (8.14.1/8.14.1) with ESMTP id l5O1R5BC028048

for ; Sat, 23 Jun 2007 19:27:19 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from web35 ([68.168.75.142]) by mta9.adelphia.net

(InterMail vM.6.01.05.02 201-2131-123-102-20050715) with ESMTP

id <20070624012657.CXYZ6326.mta9.adelphia.net@web35>;

Sat, 23 Jun 2007 21:26:57 -0400

Message-ID: <248049.1182648417907.JavaMail.root@web35>

Date: Sat, 23 Jun 2007 18:26:57 -0700

From: "sgtjarvisreeves008@yahoo.com.cn"

Reply-To: sgtjarvisreeves008@yahoo.com.cn

Subject: {Spam?} HELLO!

X-Priority: 3 (Normal)

Sensitivity: Normal

X-NetKnow-InComing-4.61.3-1-MailScanner: Found to be clean, Found to be clean

X-NetKnow-InComing-4.61.3-1-MailScanner-SpamCheck: spam, SORBS-DNSBL,

SORBS-SPAM, RFC-IGNORANT-POSTMASTER, RFC-IGNORANT-ABUSE,

SpamAssassin (not cached, score=2.348, required 1,

BOTNET_SERVERWORDS 0.00, MISSING_HEADERS 1.58, RDNS_NONE 0.10,

URG_BIZ 0.67)

X-NetKnow-InComing-4.61.3-1-MailScanner-SpamScore: ss

X-Spam-Status: Yes, No

X-NetKnow-InComing-4.61.3-1-MailScanner-Information: Please contact the ISP for more information

X-NetKnow-InComing-4.61.3-1-MailScanner-From: doctor@doctor.nl2k.ab.ca

X-UIDL: *T""!C&N!!4$D"!f_*"!

X-Antivirus: AVG for E-mail 7.5.472 [269.9.6/862]

Mime-Version: 1.0

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=utf-8





--

Hello Pal,

I hope my email meets you well. I am in need of your assistance. My name is Sgt Jarvis Reeves. I am a military attache with the Engineering unit here in Ba'qubah Iraq for the united state, we have about $25 Million dollars that we want to move out of the country. My partners and I need a good partner someone we can trust to actualize this venture.The money is from oil proceeds and legal.But we are moving it through diplomatic means to your house directly or a safe and secured location of your choice using diplomatic courier services.But can we trust you? Once the funds get to you, you take your 40% out

and keep our own 60%. Your own part of this deal is to find a safe place where the funds can be sent to. Our own part is sending it to you. If you are interested I will furnish you with more details,Awaitingyoururgentresponse.sgtjarvisreeves008@yahoo.com.cn

Your Buddy. Sgt Jarvis Reeves



--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.









--

No virus found in this incoming message.

Checked by AVG Free Edition.

Version: 7.5.472 / Virus Database: 269.9.6/862 - Release Date: 6/22/2007 3:04 PM



FRom Our logs:



gzcat /var/log/maillog.0.gz | egrep 248049.1182648417907.JavaMail.root@web35

Jun 23 19:27:20 doctor sendmail[28047]: l5O1R5wK028047: from=, size=1506, class=0, nrcpts=1, msgid=<248049.1182648417907.JavaMail.root@web35>, proto=ESMTP, daemon=MTA, relay=mta9.adelphia.net [68.168.78.199]

Jun 23 19:27:20 doctor sendmail[28048]: l5O1R5BC028048: from=, size=1506, class=0, nrcpts=1, msgid=<248049.1182648417907.JavaMail.root@web35>, proto=ESMTP, daemon=MTA, relay=mta9.adelphia.net [68.168.78.199]



whois 68.168.78.199

BW whois 3.4 by Bill Weinman (http://whois.bw.org/)

Copyright 1999-2003 William E. Weinman

Request: 68.168.78.199

connected to whois.arin.net [192.149.252.44:43] ...

Road Runner HoldCo LLC COUDERSPORT-1 (NET-68-168-64-0-1)

68.168.64.0 - 68.168.95.255

Adelphia 68168640-Z14 (NET-68-168-64-0-2)

68.168.64.0 - 68.168.79.255



# ARIN WHOIS database, last updated 2007-06-23 19:10

# Enter ? for additional hints on searching ARIN's WHOIS database.